Loading ToolBench
10-tool message security suite for AI agents (8 paid + 2 free). Protects against phishing, BEC, malware, social engineering, manipulation, AI-generated images, and deepfakes across any message format (emails, chats, DMs, SMS), URLs, replies, threads, attachments, sender identities, and media.
Agent Safe MCP provides 10 security-focused tools with complete input schemas and descriptions. All tools have verb-noun naming (check_*, analyze_*, assess_*, submit_*) and detailed parameter documentation. However, output schemas are not documented in the source code, descriptions lack LLM-optimized guidance on WHEN to use each tool vs alternatives, and error handling patterns are not visible. The assess_message and submit_feedback tools have overly broad, union-like input schemas that conflate multiple concerns. No tool annotations (readOnlyHint/destructiveHint) are present despite clear risk profiles.
Analyze a full email conversation thread for escalating social engineering, scope creep, and manipulation patterns.
FREE triage tool — send whatever context you have and get a prioritized list of which security tools to run. No charge, instant response. Call this first.
Assess attachments for malware risk based on filename, MIME type, and size BEFORE opening/downloading.
Analyze an email for phishing, social engineering, prompt injection, CEO fraud, and data exfiltration. Returns verdict, risk score, threats, and actions.
Analyze images and short videos to assess whether they are AI-generated, deepfaked, or authentic. Uses multi-layer forensic analysis.
Analyze non-email messages (SMS, WhatsApp, Instagram DMs, Discord, Slack, etc.) for platform-specific threats like smishing, wrong-number scams, and OTP interception.
assess_message has a union-like schema accepting 14 optional parameters from different tools (from, subject, body, links, attachments, platform, messages, draftTo, draftBody, media, imageUrl, videoUrl, etc.). This violates single-responsibility and forces LLMs to reason about which subset to pass. Should be split into domain-specific triage tools or accept a single 'context' object.
No output schemas documented in source code. LLMs cannot plan downstream actions or extract specific fields from responses. Responses are returned as JSON strings via mcpSuccess() but the structure is not declared in tool definitions.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | 2026-07-28+ | v2 |
Check a draft email reply BEFORE sending for data leakage, social engineering compliance, and unauthorized disclosure.
Verify sender identity and detect BEC, spoofing, and impersonation. Includes live DNS DMARC and RDAP domain age checks.
Analyze URLs for phishing, malware, redirects, spoofing, and tracking. Returns per-URL and overall verdicts.
FREE — Submit feedback about any Agent Safe tool you used. No charge, no auth required.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk profiles. check_email_safety, check_url_safety, etc. are read-only; submit_feedback is destructive (writes feedback). Annotations enable agents to reason about safety and retry logic.
Descriptions lack WHEN-to-use guidance. 'Analyze an email for phishing...' states WHAT but not WHEN to call this vs check_sender_reputation or check_response_safety. LLMs need explicit disambiguation to select the right tool.
Error handling patterns not visible in source. mcpError() returns JSON but no guidance on retryability, user-fixable vs fatal, or recovery steps. Agents cannot determine next action on failure.